H20 Pro RK3528 M16-R6B-L3-V1.0 bricked after writing U-Boot to eMMC - need Maskrom pins

[himigs]

Hi,

I need help identifying the Maskrom/eMMC short points for an RK3528 TV box.

Device:
- TV box sold as H20 Pro
- SoC confirmed as Rockchip RK3528
- Board marking: M16-R6B-L3-V1.0-260121
- RAM detected in Linux: 963 MiB
- eMMC detected in Linux: 7.83 GB / 7.30 GiB
- eMMC name from Linux: P1J95K
- eMMC CID: fe014e50314a39354b12739109744200

What happened:
- The box originally booted Android from eMMC.
- Armbian booted successfully from SD using a customized joilg/x88pro-based image.
- Later I wrote U-Boot/idbloader to eMMC:
  - idbloader.img at sector 64
  - u-boot.itb at sector 16384
- After reboot, the board no longer boots from SD or eMMC.
- LED stays red.
- No HDMI output.
- No Ethernet link/activity.
- RKDevTool on Windows shows "No Devices Found".

Recovery attempts:
- Tried the reset/recovery button behind the AV/P2 jack while connecting power and USB.
- Tried both USB ports.
- Tried RKDevTool v2.86 with Rockchip drivers installed.
- No Loader or Maskrom device appears.
- Tried UART pads marked GND/TX/RX using ESP32-C3 as bridge, but output is not readable.

Question:
Can anyone identify the eMMC Maskrom short point for this board?
I need to force RK3528 into Maskrom mode so I can restore the first bootloader area of the eMMC.

Attached photos:
- Front of board
- Back of board
- Macro photo of the eMMC/storage chip area
- Macro photo of test pads near the storage chip

[WINEDS]

Last photo just to the right of the rk3528 at 3 o'clock are the most likely (the two round gold pins).  With power off check with a multi meter if one of them is connected to ground.  Then with power applied use an oscilloscope to check if the other one has a clock signal on it.  If it has these are probably the maskrom pins.  Credit to @Hqnicolas

Edited July 7 by WINEDS

[Hqnicolas]

 

You can try to short the EMMC that wasn't connected, to short the CLK and GND of the soldered EMMC

 

 

Quote

 

 

 

 

 

 

Quote

 

also check this points to:

 

Quote

 

[stepan]

@himigs stupid question, but I'm a total noob in hardware tinkering. On the 4th pic, you have the attached header with pins to UART. Please, tell me, was it necessary to solder it or there are means to connect it without soldering.